Critical PHP flaws force European government sites offline

Government agencies across Europe temporarily shut down public-facing websites on Oct. 21 to protect systems from two critical vulnerabilities in PHP. These preventive outages affected services in the Netherlands, Germany, France, Belgium, and Finland, with no confirmed breaches reported at the time.

The flaws, identified as CVE-2026-109618 and CVE-2026-109619, enable attackers to execute malicious code on servers without needing login credentials. According to Google Cloud’s security analysis, both issues carry a severity score of 9.2 under CVSS v4.0, classifying them as critical threats to system integrity.

Scope of the disruption

Public sector websites were the primary targets of this precautionary action. The Dutch government confirmed that key portals, including Overheid.nl, MijnOverheid.nl, and DigiD, were taken offline. Similarly, Germany’s federal IT provider suspended several sites, while France disabled prefecture websites and Finland’s state IT center halted public web services.

According to Reuters, the impact extended beyond government portals. Websites operated by schools, hospitals, and other organizations across Europe also faced disruptions. These shutdowns were designed to isolate vulnerable systems while administrators worked to apply emergency patches released on Oct. 21.

Who is affected

Any organization relying on PHP to power websites, content management systems, or business applications is potentially at risk. The PHP project’s security advisory notes that the vulnerabilities allow unauthenticated remote code execution under certain conditions. This means attackers do not need valid user accounts to compromise a server, making any internet-facing PHP application a potential target.

The European Union’s cybersecurity response team, CERT-EU, advised organizations that could not patch immediately to consider isolating vulnerable internet-facing applications. This guidance highlights the immediate risk to any entity running unpatched versions of the software, regardless of sector.

Our take on the response

The rapid coordination to take sites offline demonstrates a proactive approach to critical infrastructure protection. By shutting down services before confirmation of exploitation, agencies prioritized security over availability. This suggests that the threat landscape for widely used web technologies requires swift, decisive action when high-severity flaws emerge.

For customers and users

When government or service websites go offline due to security updates, assume the suspension is a protective measure rather than a sign of a data breach. Check official social media accounts or alternative communication channels for status updates. Be cautious of emails or messages claiming to offer immediate access or urgent password resets during such outages, as these are common tactics used in follow-up phishing campaigns. Do not ignore unexpected service interruptions; instead, verify the status through trusted, independent sources before taking any action on your accounts.

What to do and how to stay safe: PHP

• Verify if your organization uses PHP and check for updates to address recent critical vulnerabilities.
• Monitor official channels for confirmation that services have resumed normal operation after maintenance.
• Isolate any internet-facing applications that cannot be immediately patched to prevent potential exploitation.
• Watch for suspicious communications claiming to resolve access issues during or after service outages.

Step-by-step guide: Data Brokers Examples: How They Collect and Sell Your Personal Info

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Were any government systems actually hacked during these outages?

No, officials confirmed there were no indications of active exploitation when the websites were taken offline.

Which PHP vulnerabilities caused these outages?

The disruptions were caused by CVE-2026-109618 and CVE-2026-109619, which allow remote code execution without authentication.

When were patches released for these issues?

Emergency patches were released on Oct. 21 to address the critical vulnerabilities.